> For the complete documentation index, see [llms.txt](https://docs.docontrol.io/docontrol-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.docontrol.io/docontrol-user-guide/workflows/define-workflow-settings/action-settings/remediate/google-drive-remediation.md). # Google Drive remediation DoControl provides your organization with an automated way to detect and prevent unnecessary or dangerous exposure on Google Drive. You can implement these remediation actions in automated workflows across Google Drive permissions and assets: * [Change owner](#change-owner) * [Move file](#move-file) * [Delete file](#delete-file) * [Prevent malware propagation](#prevent-malware-propagation) * [Remove collaborator](#remove-collaborator) * [Add collaborator](#add-collaborator) * [Remove sharing links](#remove-sharing-links) * [Remove web publishing](#remove-web-publishing) * [Add Google label](#add-google-label) {% hint style="success" %} To run remediation on any number of Google Drive files, see [bulk remediation](/docontrol-user-guide/workflows/bulk-remediation.md). {% endhint %} {% hint style="warning" %} Note the limitation in Google Shared Drives: You cannot remove file or folder access permissions if a user has inherited permissions from a folder parent in the drive. **Example 1**: If Joe is a Shared Drive manager (with the highest permission) and you try to remove his access to a specific file, you won't be able to since Joe is manager of the entire Shared Drive. **Example 2**: If Nicole has permission to view a Shared Drive folder and you try to remove her permission from a specific file, you cannot, since Nicole still has permission granted by the parent folder. To remove Nicole's user permission, you have to remove it from the shared parent folder or drive. {% endhint %} When DoControl remediates a Google Drive asset, the incoming event shown in the [Events](/docontrol-user-guide/saas-data-monitoring/events.md) page includes the **actor** as follows:
Google DriveActor
My DriveAsset owner
Shared DriveDrive owner
{% hint style="success" %} Assets of **archived** users (Google users who were terminated) can also be remediated by DoControl. {% endhint %} ## Change owner If an employee leaves the company or is terminated, you need to manage all Google Drive assets that were owned by the employee in My Drive. With DoControl, you can set up an automatic workflow to change the asset owner to be someone else. 1. In Workflows, select **New workflow**. 2. Give an action name and select the **Google Drive > Access control list changed** event. 3. Define the relevant conditions, including that the actor email is included in the group of terminated employees. 4. From the Actions pane, select **Remediate > Google Drive > Change asset owner** and enter the email of the new asset owner. The asset owner of the Google Drive file is automatically changed.
## Move file You can move files from a shared drive to another shared drive, or to the integration admin's My Drive. There are several use cases that require moving large numbers of files from a Google shared drive: * **Data retention policy** - To address compliance requirements, you can archive unviewed Google files in a dedicated drive instead of deleting them immediately. This process can be conducted [on-demand](/docontrol-user-guide/workflows/inventory-actions-quick-actions/google-drive-inventory-actions/move-file.md), or as a [scheduled workflow](#schedule-workflow-to-move-files). * **Organizational change** - Reorganizing teams or departments might require moving files to align with the new organizational structure. This can also happen as a result of mergers and acquisitions. * **Compliance needs** - To meet regulatory or auditing demands, data is often segregated by ethical walls: sensitive data is isolated from general company information. Rapidly changing the file structure in Google shared drive helps to efficiently address compliance policies. * **Operational requirements** - When migrating from legacy systems or personal drives, it's usually required to move large volumes of files to ensure that business-critical data is centrally managed and accessible to the relevant stakeholders. {% hint style="info" %} * Only **files** from a shared drive can be moved, not folders. * If you want to move files from a My Drive to another My Drive, use the [Change owner](#change-owner) action. {% endhint %} ### Prerequisites For this action to succeed, make sure these conditions are fulfilled: * The integration admin's user email has direct access (not in a group) to both the **origin** and **destination** folders. * The integration admin's **email** is the same email assigned to the admin user in the integration wizard. To find out what this email is, go to **Integrations > Google Workspace > Settings > Edit**. ### Sharing impact Moving files might change ownership and permissions, so we recommend that you plan migrations to avoid accidental data exposure or loss of access: * Files will gain permissions of the destination folder. * All collaborators who were not given direct access permissions, but inherited permissions from the origin folder, will be removed. * Follow best practices to minimize disruption and maintain data integrity ### Schedule workflow to move files You can set up a scheduled workflow to move files from a shared drive to another shared drive, or to the integration admin's My Drive. This automated process transfers the files without any manual intervention. 1. In Workflows, select **New workflow > Scheduled.**
2. Give the workflow a name, and click **Create workflow**. 3. For the scheduled trigger, select once a month.
4. Give a step description. 5. From the Actions pane, select **Utilities > DoControl API** and add to the trigger. 6. Define the **DoControl API** step as follows: ``` mutation StartGoogleRemediationAssessment { startGoogleRemediationAssessment( input: { autoApproveInput: { remediateInherited: true, workflowId: "", destinationParentFolderId: "" }, remediationType: GOOGLE_MOVE_ASSET, filterString: "[{\"lastViewedAt\":{\"single\":{\"operator\":\"LOWER_THAN\",\"value\":\"{{$fromMillis($toMillis($now()) - (18 * 30 * 24 * 60 * 60 * 1000))}}\"}}},{\"fileType\":{\"operator\":\"IN\",\"value\":[\"file\"]}},{\"driveType\":{\"operator\":\"IN\",\"value\":[\"SHARED_DRIVE\"]}}]" } ) { jobId remediationType updatedAt } } ``` 7. in the DoControl API step, make sure you enter the: * Workflow ID * Destination folder ID 8. Define error handling. 9. After the workflow runs, you can view the output in the execution details:
## Delete file You can set up a workflow to delete sensitive files that are uploaded to Google Drive. 1. In Workflows, select **New workflow**. 2. Give an action name and select the **Google Drive > Upload** event. 3. Define the relevant conditions, including that the document name contains words from the sensitive keyword list, or that the file is an encryption key. 4. Add an approval action asking the actor to approve the file upload. 5. From the Actions pane, select **Remediate > Google Drive > Delete file** and add to the Not approved branch. The file is automatically deleted from Google Drive.
## Prevent malware propagation DoControl customers who are using CrowdStrike Falcon to stop breaches can prevent malware from spreading in Google Drive. {% hint style="success" %} When CrowdStrike Falcon detects a malicious file on the endpoint, DoControl retrieves the event and compares the hash value with Google Drive to delete any malicious files. {% endhint %} To automatically prevent malware propagation, you can build a workflow with these components: * **Trigger event** - The endpoint malware detection event is sent to DoControl and triggers the workflow. * **Get files by hash** - Add a query action for Google Drive to retrieve all files with the hash value from the event. * **Delete file** - Add a remediation action for Google Drive to delete all potentially malicious files (via a list of Google document IDs).

Defining an automated workflow to prevent malware propagation in Google Drive

## Remove collaborator You can remove collaborator access from a Google Drive asset for one or more collaborators. When an asset exists in a parent folder, collaborator access is removed from all assets in the folder. {% hint style="info" %} * If a collaborator email is an [alias](https://support.google.com/domains/answer/6304345?hl=en), it will be displayed in DoControl events and workflows with the real user's email address, and not the alias email. * In the file asset details, the alias email might appear as the external collaborator. * Google Workspace administrators usually create email aliases for users to send and receive emails from another address within the organization's domain. * For example: is an alias email of . When a user shares a file with the alias (), DoControl detects a sharing event with the real user's email: . {% endhint %} 1. In Workflows, select **New workflow**. 2. Give an action name and select the **Google Drive > Change user access** event. 3. Define the relevant conditions, for example, that the `target email` is not in a trusted domain. 4. From the Actions pane, select **Remediate > Google Drive > Remove collaborator.** The external user access is automatically removed from the Google Drive asset.
## Add collaborator [Add new ](#add-new-collaborator)collaborators to Google assets, or [restore collaborators](#restore-removed-collaborator) who were automatically removed. {% hint style="info" %} A new collaborator can be a security team member or CISO who requires file access to investigate sensitive content. {% endhint %} ### Restore removed collaborator You can create workflows to restore collaborators who were automatically removed as part of your zero-trust security policy, and add them only after the file sharing is approved. This granular control significantly strengthens your data security posture. {% hint style="success" %} Leverage DoControl's playbook for zero-trust sharing: [Remove external collaborators and restore after approval](/docontrol-user-guide/risk-management/threat-model-coverage/external-collaborator-sharing/google-drive-playbooks-for-external-sharing.md#remove-external-collaborators-and-restore-after-approval). {% endhint %} 1. In Workflows, select **New workflow**. 2. Give an action name and select the **Google Drive > Change user access** event, or an appropriate trigger, such as **User externally shared sensitive files.** 3. Define the relevant conditions. 4. From the Actions pane, select **Remediate > Google Drive > Remove collaborator.** The external user access is automatically removed from the Google Drive asset. 5. Under Decide, select the **Approval** step to approve the file share. 6. Link the **Yes** branch of the Approval step to the **Add collaborator** step.
7. To **restore removed c**ollaborators, enter the **Get target** macro. 8. Link the **No** branch of the Approval step to the **Notify by email** step. 9. Add an **End workflow** step. ### Add new collaborator You can create workflows to add new collaborators to a Google file, especially if a security team member or CISO requires file access to investigate sensitive content. 1. In Workflows, select **New workflow**. 2. Give an action name and select the **Google Drive > Change user access** event, or an appropriate trigger**.** 3. Define the relevant conditions. 4. From the Actions pane, select **Remediate > Google Drive > Add collaborator.**
5. Under **Collaborators**, add the user emails and the collaborator role.\ The new collaborators and their role are displayed in the workflow output:
## Remove sharing links Assets with publicly shared links on Google Drive increase the risk of data compromise. Even when an asset is shared across the organization, there's a risk of breaching "ethical walls" between departments. You can define a workflow to automatically remove the sharing links of Google Drive assets for each different link type: * **Public** - Removes publicly shared links * **Organization** - Removes organization-wide links * **Any link** - Removes any kind of sharing link {% hint style="success" %} * It's best practice to grant each group or department only the necessary sharing capabilities to maintain business continuity with least privilege access. * Each Google file has only one sharing link. If you remove the public sharing link, you automatically remove the "Anyone with the link" setting from the file. The file will have no sharing link whatsoever. {% endhint %} #### To remove sharing links: 1. In Workflows, select **New workflow.** 2. Give an action name and select the **Google Drive > Change user access** event. 3. Define the relevant conditions, including that the asset is publicly shared:\ `is publicly shared is True` 4. From the Actions pane, select **Remediate > Google Drive > Remove sharing links.**
5. Enter the Asset ID. 6. Select the link type you wish to remove. Each Google file has only one sharing link. Only the link type you select is automatically removed from the Google Drive asset: * Public * Organization * Any link
7. Add a **Notify by email** action to send an email message notifying the Security Team that the selected sharing links were removed. {% hint style="success" %} * If you remove the **public sharing** link, you automatically remove the "Anyone with the link" permission setting from the file. The remediation action for removing public links also exists as an inventory action: [Remove public sharing](/docontrol-user-guide/workflows/inventory-actions-quick-actions/google-drive-inventory-actions.md#remove-public-sharing). The file will have no sharing link whatsoever. * If you remove the **organization** link, you automatically remove the "Company" permission setting from the file. The remediation action for removing organization links also exists as an inventory action: [Remove org-wide sharing](/docontrol-user-guide/workflows/inventory-actions-quick-actions/google-drive-inventory-actions.md#remove-org-wide-sharing). The file will have no sharing link whatsoever. {% endhint %} ## Remove web publishing Sometimes users publish Google files to the web, where they cannot be edited, are visible to everyone, and are indexable. Published Google files can pose a significant threat to your organization in terms of data exposure, since they can be searched and found. You can remediate Google assets that were published to the web in real-time, by automatically removing the published URL link. 1. In Workflows, select **New workflow.** 2. Give an action name and select a **Google Drive > Publish change** event. 3. Define the relevant condition: \ `Get web publishing status` equals `public_on_the_web` 4. From the Actions pane, select **Remediate > Google Drive > Remove web publishing.** The URL is automatically removed from the Google Drive asset.

Apply the Remove web publishing action to remove a URL link from a Google file

## Add Google label To expedite your DLP and data security policies, you can automatically apply existing Google labels to Google assets via workflows. {% hint style="success" %} * You can apply up to 5 existing Google labels to any Google file. * The Google label you wish to add must be open to the entire organization, not restricted to specific group or organization unit. * Labels that are already applied to an asset are not changed, but field values are changed. This is a Google API limitation. {% endhint %} 1. In Workflows, select **New workflow.** 2. Give an action name and select a **Google Drive** trigger. 3. Add a **Data scan** action to scan for specific data classifiers or regex patterns. 4. Add a **Conditional** step to determine if matches were found.
5. If matches were found, connect to the **Add Google label** action 6. In the **Add Google label** step, add up to 5 existing Google labels. Make sure these labels are open to the entire organization.
7. Define error handling. 8. To inspect the outcome of the **Add Google label** action, go to your execution activity.\ All assets with added labels are indicated.
## Troubleshooting
Q. What do I need to do if Google labels were not applied? A. Make sure the Google label exists in your Google Drive, and is open to the entire organization.
Q. Why was a field value removed? A. If you update a label that has multiple fields, all the existing fields will be replaced with the new field.\ **For example:**\ Original label name: Owner\ Original field values: HR, RND
The added label in the workflow is:\ Label name: Owner\ Field value: RND \ The **HR** field value will be removed from all assets with the Owner label.\ This is based on Google API limitations.
--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.docontrol.io/docontrol-user-guide/workflows/define-workflow-settings/action-settings/remediate/google-drive-remediation.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.